[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_193":194,"_195":196},"routes/_app.x.$handle.$name",{"_102":101,"_32":45,"_111":90,"_27":112,"_13":14,"_113":-5,"_11":114,"_115":116,"_117":118,"_119":120,"_121":122,"_20":-5,"_123":-5,"_124":125,"_126":25,"_127":128,"_129":59,"_130":-5,"_131":-5,"_132":133},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":83,"_84":85,"_86":87,"_88":25},"version",2,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.tsx","latestPath","fileId","01a03a2b-f076-7037-be66-2bf750d5bc2e","name","fileType","http","content","import { blob } from \"https://esm.town/v/std/blob/main.ts\";\nconst TOKEN = Deno.env.get(\"DASH_TOKEN\") || \"\";\n\nasync function serveGz(which: string): Promise {\n const res = await blob.get(\"gz:\" + which); // throws if key missing\n const html = await new Response(res.body!.pipeThrough(new DecompressionStream(\"gzip\"))).text();\n return new Response(html, {\n status: 200,\n headers: { \"content-type\": \"text/html; charset=utf-8\", \"cache-control\": \"no-store\" },\n });\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const path = url.pathname.replace(/\\/+$/, \"\");\n if (path === \"\" || path === \"/health\") return new Response(\"ok\", { status: 200 });\n let which: string | null = null;\n if (path === \"/amanda\") which = \"amanda\";\n else if (path === \"/share\") which = \"share\";\n if (!which) return new Response(\"Not found\", { status: 404 });\n const k = url.searchParams.get(\"k\") || \"\";\n if (!TOKEN || k !== TOKEN) return new Response(\"Unauthorized\", { status: 401 });\n try {\n return await serveGz(which);\n } catch (_e) {\n return new Response(\"Dashboard not published yet.\", { status: 503 });\n }\n}\n","/**\n * TerraClear SY27 dashboards — access gate.\n *\n * Humans: log in with Val Town. Allowed if their account email is on an allowed\n * domain (and not blocklisted). /amanda is owner-only; everyone else gets /share.\n * Machines: the refresh pipeline passes ?k= and skips OAuth entirely,\n * so a broken login flow can never lock out publishing or verification.\n *\n * The dashboards themselves live in blobs (gz:amanda / gz:share) — this file only\n * decides who may see them and never touches the data.\n */\nimport { Hono } from \"npm:hono\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport {\n getOAuthUserData,\n oauthMiddleware,\n} from \"https://esm.town/v/std/oauth/middleware.ts\";\n\nconst TOKEN = Deno.env.get(\"DASH_TOKEN\") || \"\";\nconst OWNER = (Deno.env.get(\"OWNER_EMAIL\") || \"\").trim().toLowerCase();\nconst ALLOWED_DOMAINS = [\"terraclear.com\", \"spinutech.com\"];\n\nconst blocked = () =>\n new Set(\n (Deno.env.get(\"BLOCKED_EMAILS\") || \"\")\n .toLowerCase()\n .split(\",\")\n .map((s) => s.trim())\n .filter(Boolean),\n );\n\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS access_log (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n ts TEXT NOT NULL,\n email TEXT,\n username TEXT,\n route TEXT,\n verdict TEXT,\n allowed INTEGER\n)`);\n\n/** owner | team | blocked | off-domain | no-email */\nfunction decide(email: string): string {\n const e = (email || \"\").trim().toLowerCase();\n if (!e) return \"no-email\";\n if (blocked().has(e)) return \"blocked\";\n if (e === OWNER) return \"owner\";\n const domain = e.split(\"@\")[1] || \"\";\n return ALLOWED_DOMAINS.includes(domain) ? \"team\" : \"off-domain\";\n}\n\nasync function log(\n email: string,\n username: string | null,\n route: string,\n verdict: string,\n allowed: boolean,\n) {\n try {\n await sqlite.execute({\n sql:\n \"INSERT INTO access_log (ts, email, username, route, verdict, allowed) VALUES (?, ?, ?, ?, ?, ?)\",\n args: [\n new Date().toISOString(),\n email || null,\n username || null,\n route,\n verdict,\n allowed ? 1 : 0,\n ],\n });\n } catch (_e) {\n // Never let logging break a page view.\n }\n}\n\nasync function serveGz(which: string): Promise {\n const res = await blob.get(\"gz:\" + which);\n const html = await new Response(\n res.body!.pipeThrough(new DecompressionStream(\"gzip\")),\n ).text();\n return new Response(html, {\n status: 200,\n headers: {\n \"content-type\": \"text/html; charset=utf-8\",\n \"cache-control\": \"no-store\",\n },\n });\n}\n\nconst page = (title: string, body: string) =>\n `\n${title}\n\n${body}`;\n\nconst app = new Hono();\napp.onError((err) => Promise.reject(err));\n\n// Health check — deliberately open, no data behind it.\napp.get(\"/\", (c) => c.text(\"ok\"));\napp.get(\"/health\", (c) => c.text(\"ok\"));\n\n/** Resolve the viewer once: machine token, or an OAuth session. */\nasync function viewer(c: any) {\n if (TOKEN && c.req.query(\"k\") === TOKEN) {\n return { machine: true, email: \"\", username: null, verdict: \"token\" };\n }\n const session = await getOAuthUserData(c.req.raw);\n if (!session?.user) return null;\n const email = session.user.email || \"\";\n return {\n machine: false,\n email,\n username: session.user.username,\n verdict: decide(email),\n };\n}\n\nconst denied = (c: any, email: string, verdict: string) =>\n c.html(\n page(\n \"No access\",\n `

No access to this dashboard

You're signed in as ${email || \"an account with no email\"}${\n verdict === \"blocked\" ? \", which has been blocked\" : \"\"\n }.\nAccess is limited to TerraClear and Spinutech accounts.

If you have a work email, sign out and sign back in with it.

\n`,\n ),\n 403,\n );\n\napp.get(\"/share\", async (c) => {\n const v = await viewer(c);\n if (!v) return c.redirect(\"/auth/login\");\n if (v.machine) return serveGz(\"share\");\n const ok = v.verdict === \"owner\" || v.verdict === \"team\";\n await log(v.email, v.username, \"/share\", v.verdict, ok);\n return ok ? serveGz(\"share\") : denied(c, v.email, v.verdict);\n});\n\napp.get(\"/amanda\", async (c) => {\n const v = await viewer(c);\n if (!v) return c.redirect(\"/auth/login\");\n if (v.machine) return serveGz(\"amanda\");\n await log(v.email, v.username, \"/amanda\", v.verdict, v.verdict === \"owner\");\n if (v.verdict === \"owner\") return serveGz(\"amanda\");\n // Team members land on the dashboard meant for them rather than a dead end.\n if (v.verdict === \"team\") return c.redirect(\"/share\");\n return denied(c, v.email, v.verdict);\n});\n\n// Access log — owner only.\napp.get(\"/who\", async (c) => {\n const v = await viewer(c);\n if (!v) return c.redirect(\"/auth/login\");\n if (!v.machine && v.verdict !== \"owner\") return c.notFound();\n const { rows } = await sqlite.execute(\n \"SELECT ts, email, username, route, verdict, allowed FROM access_log ORDER BY id DESC LIMIT 200\",\n );\n const body = rows.length\n ? `` +\n rows\n .map(\n (r: any) =>\n `${r.allowed ? \"allowed\" : \"denied · \" + r.verdict}`,\n )\n .join(\"\")\n : \"

No sign-ins recorded yet.

\";\n return c.html(\n page(\n \"Dashboard access log\",\n `

Dashboard access log

Most recent 200 views. Machine\n(pipeline) requests are not logged.

${body}`,\n ),\n );\n});\n\napp.notFound((c) => c.html(page(\"Not found\", \"

Not found

\"), 404));\n\nexport default oauthMiddleware(app.fetch);\n","createdAt",["D",1787682397415],"branchVersion","branchId","5f1994a9-671c-4ea6-bf22-1938cc99523f","id","c9f048c5-e98a-4ba5-b3b5-6f64ac009b82","sy27-dashboards",["D",1787333497510],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","TerraClear SY27 digital dashboards (private, token-gated)","imageUrl","b02b181d-acdd-41c7-966b-7ee33571e414","pinnedFileId","29bdcbfe-9d86-11f1-9801-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0211b-3ceb-71a5-a4e8-34becf953d3e","tursoName","c9f048c5e98a4ba5b3b56f64ac009b82","tursoHostname","c9f048c5e98a4ba5b3b56f64ac009b82-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789510270483],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_102":101,"_110":106},"org",{"_102":101,"_103":104,"_105":106,"_18":-5,"_107":108,"_109":25},"branch",{"_13":89,"_32":90,"_43":42,"_91":44,"_92":93,"_94":95,"_96":50,"_97":44,"_98":65,"_99":45,"_100":101},"isOwned",9,"auth","projectId","forkedBranchId","682dc73b-ce03-4bd6-bc9d-1ea55e51846d","forkedBranchVersion",22,"forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","terraclear","handle","displayName","Terraclear","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/3fbd6d7f-43ca-409d-22e4-7e3b2a373e00/square512?exp=1789559999&sig=762a16770e2ae71ead9e85ef1381bc0e76c8abf47215f414265a45f0e1507b0f","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":188,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":189,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":190,"_84":191,"_86":192,"_88":25},"tree",[175,176,177],"files",[175,176,177],"counts",{"_164":63,"_165":14,"_166":148,"_167":168,"_169":170},"contents",[141,142,143],"upstreamProject","upstreamBranch",{"_43":93,"_38":134,"_135":136,"_32":137,"_91":44,"_13":138,"_92":-5,"_94":-5,"_139":140,"_47":-5,"_88":25,"_49":50,"_100":101,"_64":65,"_99":45},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1787333497510],"updatedAt",["D",1789404709338],"main",122,"lockfileKey","1789404709437-esm.town_v_terraclear_sy27-dashboards@122-main",{"_43":158,"_32":159,"_30":160,"_145":-5,"_41":42,"_40":148,"_146":59,"_38":161,"_13":63,"_33":155,"_35":162,"_24":25,"_149":-5,"_27":163},{"_43":151,"_32":152,"_30":153,"_145":-5,"_41":42,"_40":148,"_146":59,"_38":154,"_13":63,"_33":155,"_35":156,"_24":25,"_149":-5,"_27":157},{"_43":144,"_32":28,"_30":31,"_145":-5,"_41":42,"_40":14,"_146":25,"_38":147,"_13":148,"_33":34,"_35":37,"_24":25,"_149":-5,"_27":150},"fe1cb74e-9d46-4cae-91fa-be07d89a4da2","parentId","latest",["D",1787682397415],1,"label",[28],"d97a1f30-6b6c-4a56-8814-ffe062da933e","assemble.ts","01a03a2b-f076-7037-be66-26df603d7750",["D",1787682353284],"script","import { blob } from \"https://esm.town/v/std/blob/main.ts\";\n// Reassemble chunked (gzip+base64) uploads raw::NNN into the live HTML blob live:.\nconst out: Record = {};\nfor (const which of [\"amanda\", \"share\"]) {\n const entries = (await blob.list(\"raw:\" + which + \":\")).sort((a, b) => (a.key < b.key ? -1 : 1));\n if (!entries.length) { console.log(\"no chunks for\", which); continue; }\n let b64 = \"\";\n for (const e of entries) { const r = await blob.get(e.key); b64 += await r.text(); }\n const gz = Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));\n const stream = new Response(gz).body!.pipeThrough(new DecompressionStream(\"gzip\"));\n const html = await new Response(stream).text();\n await blob.set(\"live:\" + which, html);\n out[which] = { chunks: entries.length, bytes: html.length };\n for (const e of entries) await blob.delete(e.key);\n}\nconsole.log(\"ASSEMBLED \" + JSON.stringify(out));\n",[152],"4fd5667e-7ff5-4e0b-8e43-f4d71e0e2574","asm_probe.ts","01a03a2b-f076-7037-be66-20993aa2afe6",["D",1787682353284],"import { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\nasync function sha256Hex(s: string): Promise {\n const data = new TextEncoder().encode(s);\n const digest = await crypto.subtle.digest(\"SHA-256\", data);\n return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nconst keys = await blob.list(\"asm:\");\nconst probeKey = \"asm:raw:share:004:00\";\nconst val = await blob.getJSON === undefined ? null : null; // noop\nconst text = await (await blob.get(probeKey)).text();\nconsole.log(JSON.stringify({\n listedKeys: keys.map((k: any) => k.key ?? k),\n probeKey,\n probeLen: text.length,\n probeSha256: await sha256Hex(text),\n expectedSha256: \"61b6440d2afdf9704fcbf0a0b8f7531e168f4f7a608c5be840bfdfa5fabd0012\",\n}, null, 2));\n",[159],"pulls","branches","forks","envVars",{"_171":173,"_174":148},"connections",{"_171":63,"_172":63},"count","unfilledCount",3,"emptyCount",{"_43":158,"_32":159,"_30":160,"_145":-5,"_41":42,"_40":148,"_146":59,"_38":185,"_13":63,"_33":155,"_35":162,"_24":25,"_149":-5,"_179":186,"_27":187},{"_43":151,"_32":152,"_30":153,"_145":-5,"_41":42,"_40":148,"_146":59,"_38":182,"_13":63,"_33":155,"_35":156,"_24":25,"_149":-5,"_179":183,"_27":184},{"_43":144,"_32":28,"_30":31,"_145":-5,"_41":42,"_40":14,"_146":25,"_38":178,"_13":148,"_33":34,"_35":37,"_24":25,"_149":-5,"_179":180,"_27":181},["D",1787682397415],"children",[],[28],["D",1787682353284],[],[152],["D",1787682353284],[],[159],["D",1787333497510],["D",1789510270483],{"_102":101,"_110":106},{"_102":101,"_103":104,"_105":106,"_18":-5,"_107":108,"_109":25},{"_13":89,"_32":90,"_43":42,"_91":44,"_92":93,"_94":95,"_96":50,"_97":44,"_98":65,"_99":45,"_100":101},"ctx",{"_82":-5,"_131":226,"_227":228,"_229":230,"_231":25,"_232":25,"_233":25,"_234":59,"_235":-5,"_236":-7,"_237":-7,"_238":63,"_239":25,"_240":25,"_241":-5,"_242":25,"_243":25,"_244":25,"_245":-5},"ENV",{"_197":198,"_199":200,"_201":137,"_202":203,"_204":205,"_206":207,"_208":209,"_210":211,"_212":213,"_214":215,"_216":217,"_218":219,"_220":221,"_222":223,"_224":225},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

When (UTC)	Email	Val Town	Route	Result
${String(r.ts).replace(\"T\", \" \").slice(0, 19)}	${\n r.email ?? \"—\"\n }	${r.username ?? \"—\"}	${r.route}

Diff · v2